Research Article
Application of Large Language Models to DDoS Attack Detection
@INPROCEEDINGS{10.1007/978-3-031-51630-6_6, author={Michael Guastalla and Yiyi Li and Arvin Hekmati and Bhaskar Krishnamachari}, title={Application of Large Language Models to DDoS Attack Detection}, proceedings={Security and Privacy in Cyber-Physical Systems and Smart Vehicles. First EAI International Conference, SmartSP 2023, Chicago, USA, October 12-13, 2023, Proceedings}, proceedings_a={SMARTSP}, year={2024}, month={2}, keywords={Cybersecurity DDoS Attack Large Language Model}, doi={10.1007/978-3-031-51630-6_6} }- Michael Guastalla
Yiyi Li
Arvin Hekmati
Bhaskar Krishnamachari
Year: 2024
Application of Large Language Models to DDoS Attack Detection
SMARTSP
Springer
DOI: 10.1007/978-3-031-51630-6_6
Abstract
Network security remains a pressing concern in the digital era, with the rapid advancement of technology opening up new avenues for cyber threats. One emergent solution lies in the application of large language models (LLMs), like OpenAI’s ChatGPT, which harness the power of artificial intelligence for enhanced security measures. As the proliferation of connected devices and systems increases, the potential for Distributed Denial of Service (DDoS) attacks—a prime example of network security threats—grows as well. This article explores the potential of LLMs in bolstering network security, specifically in detecting DDoS attacks. This paper investigates the aptitude of large language models (LLMs), such as OpenAI’s ChatGPT variants (GPT-3.5, GPT-4, and Ada), in enhancing DDoS detection capabilities. We contrasted the efficacy of LLMs against traditional neural networks using two datasets: CICIDS 2017 and the more intricate Urban IoT Dataset. Our findings indicate that LLMs, when applied in a few-shot learning context or through fine-tuning, can not only detect potential DDoS threats with significant accuracy but also elucidate their reasoning. Specifically, fine-tuning achieved an accuracy of approximately 95% on the CICIDS 2017 dataset and close to 96% on the Urban IoT Dataset for aggressive DDoS attacks. These results surpass those of a multi-layer perceptron (MLP) trained with analogous data.
